dekont[.]pdf[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

dekont.pdf.exe
Size

815KB
MD5

fb73a2982483561239bd36899e4fb1a8
SHA1

634dc59de8afc5d1816957d707be594a04579701
SHA256

9925d40e552d694f23587880808c8f53cb41ff2ef2fc5112f37aeaab7d1c6241
SHA512

09a42e0839032dfaeb10e6ad4b1b41567880c39274dc66f9bf9d389e69484d4bee3e88c2ddbfc3cf563617a82a14e023c129b15e02465e3e5f0ef3fc59d87406
SSDEEP

12288:jkXHmEooZfOtXyiZgw3AIqnM/SgwTnZ4BDzW7Qq6bAo:jsmlWqXTKw3oeSZWXWkq6bl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dekont.pdf.exe

Files

dekont.pdf.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 781KB - Virtual size: 781KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ